Data protection principles

When giving advice or investigating complaints about organisations which are not obliged to comply with the Information Protection Principles (IPPs) in the Privacy and Personal Information Protection Act 1998 (PPIP Act) or the Health Privacy Principles (HPPs) in the Health Records and Information Privacy Act 2002 (HRIP Act,) the Information and Privacy Commission NSW (IPC) has formally adopted the data protection principles (DPPs) developed by the New South Wales Privacy Committee in 1991.

Data protection principles

The data protection principles have a more general application and are not subject to the exemptions which apply to the IPPs under the PPIP Act or the HPPs under the HRIP Act. They correspond closely to the information privacy principles in the Commonwealth Privacy Act 1988. The DPPs can therefore be seen as a best practice guide for activities not regulated by specific privacy legislation.

Principle 1 - Manner and purpose of collection of personal information

1. Personal information shall not be collected by a collector for inclusion in a record or in a generally available publication unless:

(a) the information is collected for a purpose that is a lawful purpose directly related to a function or activity of the collector; and

(b) the collection of the information is necessary for or directly related to that purpose.

2. Personal information shall not be collected by a collector by unlawful or unfair means.

Principle 2 - Solicitation of personal information from individual concerned

1. Personal information shall be solicited directly from the individual concerned except where the individual authorises otherwise, or where personal information may be disclosed to the collector in accordance with these Principles.

2. Where:

(a) a collector collects personal information for inclusion in a record or in a generally available publication; and

(b) the information is solicited by the collector from the individual concerned;

the collector shall take such steps (if any) as are, in the circumstances, reasonable to ensure that, before the information is collected or, if that is not practicable, as soon as practicable after the information is collected, the individual concerned is informed of:

(c) the purpose for which the information is being collected;

(d) if the collection of the information is authorised or required by or under law – the fact that the collection of the information is so authorised or required;

(e) the mandatory or voluntary nature of the information collection and the effects on the individual concerned, if any, of not providing all or any part of the requested information;

(f) the existence of the right of access to and rectification of the data relating to the individual;

(g) the name and address of the recordkeeper;

(h) any person to whom, or any body or agency to which, it is the collector's usual practice to disclose personal information of the kind so collected, and (if known by the collector) any person to whom, or any body or agency to which, it is the usual practice of that first mentioned person, body or agency to pass on that information.

Principle 3 - Solicitation of personal information generally

Where:

(a) a collector collects personal information for inclusion in a record or in a generally available publication; and

(b) the information is solicited by the collector;

the collector shall take steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is collected;

(c) the information collected is relevant to that purpose, not excessive, and is accurate, up to date and complete; and

(d) the collection of the information does not intrude to an unreasonable extent upon the personal affairs of the individual concerned.

Principle 4 - Storage and security of personal information

A recordkeeper who has possession or control of a record that contains personal information shall ensure that the personal information is:

(a) stored for specified, explicit and lawful purposes and used in a way consistent with those purposes;

(b) adequate, relevant, and not excessive in relation to the purposes for which it is stored;

(c) processed fairly and lawfully;

(d) kept for no longer than is necessary for the purposes for which the information is stored;

(e) personal information is protected, by such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorised access, use, modification or disclosure, and against other misuse; and

(f) if it is necessary for the personal information to be given to a person in connection with the provision of a service to the recordkeeper, everything reasonably within the power of the recordkeeper is done to prevent unauthorised use or disclosure of the information.

Principle 5 - Information relating to records kept by recordkeeper

1. A recordkeeper who has possession or control of records that contain personal information shall, subject to clause 2 of this Principle, take such steps as are, in the circumstances, reasonable to enable any person to ascertain:

(a) whether the recordkeeper has possession or control of any records that contain personal information; and

(b) whether the recordkeeper has possession or control of such a record relating to that person; and

(c) if the recordkeeper has possession or control of a record that contains such information:

i) the nature of that information;
ii) the main purposes for which the information is used; and
iii) the steps that the person should take if the person wishes to obtain access to the record.

2. A recordkeeper is not required under clause 1 of the Principle to give a person information if the recordkeeper is required or authorised to refuse to give that information to the person under the applicable provisions of any law that provides for access by persons to documents.

3. A recordkeeper shall maintain a record setting out:

(a) the nature of the records of personal information kept by or on behalf of the recordkeeper;

(b) the sources of personal information contained in those records;

(c) the purpose for which the information was collected and the authority for that collection;

(d) the purpose for which each type of record is kept;

(e) the classes of individuals about whom records are kept;

(f) the period for which each type of record is kept;

(g) the persons who are entitled to have access to personal information contained in the records and the conditions under which they are entitled to have that access; and

(h) the steps that should be taken by persons wishing to obtain access to that information.

4. A recordkeeper shall make the record maintained under clause 3 of this Principle available for inspection by members of the public.

Principle 6 - Access to records containing personal information

1. Where a recordkeeper has possession or control of a record that contains personal information, the individual concerned shall, without excessive delay or expense, be entitled to have access to that record, except to the extent that the recordkeeper is required or authorised to refuse to provide the individual with access to that record under the applicable provisions of any law that provides for access by persons to documents.

Principle 7 - Alteration of records containing personal information

1. A recordkeeper who has possession or control of a record that contains personal information shall take such steps (if any), by way of making appropriate corrections, deletions and additions as are, in the circumstances, reasonable to ensure that the record:

(a) is accurate; and

(b) is, having regard to the purpose for which the information was collected or is to be used and to any purpose that is directly related to that purpose, relevant, up-to-date, complete and not misleading.

2. Where personal information has been corrected, deleted or added to in accordance with clause 1, the individual concerned shall be entitled to have recipients of that information notified of the alterations by the recordkeeper.

3. The obligation imposed on a recordkeeper by clause 1 is subject to any applicable limitation in a law of New South Wales that provides a right to require the correction or amendment of documents.

4. Where:

(a) the recordkeeper of a record containing personal information is not willing to amend that record, by making a correction, deletion or addition, in accordance with a request by the individual concerned; and

(b) no decision or recommendation to the effect that the record should be amended wholly or partly in accordance with that request has been made under the applicable provisions of any law; the recordkeeper shall, if so requested by the individual concerned, take such steps (if any) as are reasonable in the circumstances to attach to the record any statement provided by that individual of the correction, deletion or addition sought.

Principle 8 - Recordkeeper to check accuracy etc. of personal information before use

A recordkeeper who has possession or control of a record that contains personal information shall not use that information without taking such steps (if any) as are, in the circumstances, reasonable to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant accurate, up to date, complete and not misleading.

Principle 9 - Limits on use of personal information

1. A recordkeeper who has possession or control of a record that contains personal information shall not use the information for a purpose other than that for which it was collected and which was specified in accordance with Principle 5 unless:

(a) the individual concerned has consented to use of the information for that other purpose;
(b) the recordkeeper believes on reasonable grounds that use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person; or

(c) use of the information for that other purpose is required or authorised by or under law.

Principle 10 - Limits on disclosure of personal information

1. A recordkeeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless:

(a) the individual concerned has been informed under Principle 2, that information of that kind is usually passed to that person, body or agency;

(b) the individual concerned has consented to the disclosure;

(c) the recordkeeper believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person;

(d) the disclosure is required or authorised by or under law.

2. A person, body or agency to whom personal information is disclosed under clause 1 of this Principle shall not use or disclose the information for a purpose other than the purpose for which the information was given to the person, body or agency.

Principle 11 - Sensitive Information

1. Notwithstanding Principles 9 and 10, information relating to ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual life shall not be used or disclosed by a recordkeeper without the express written consent, freely given, of the individual concerned.

2. Information relating to an individual's criminal history may only be processed as required or authorised by law.